Topic starter
16/04/2026 7:04 pm
TL;DR: MFA prompt bombing works by overwhelming users with repeated approval requests after stolen passwords are used, according to RSA Security, and the post recommends pattern-based detection, tighter enrollment controls, and stronger factors for higher-risk access. Push MFA remains convenient, but approval-only assurance breaks down when attackers can spam the user faster than the control can distinguish intent.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Protect Against MFA Prompt Bombing Attacks”.
Key questions
Q: How should security teams reduce MFA prompt bombing risk?
A: Use push MFA only within a risk-based policy framework.
Q: Why does MFA prompt bombing still work when users know not to approve unknown prompts?
A: Because the attack is designed to overwhelm attention, not just knowledge.
Q: What are the signs that push-based MFA is being abused?
A: Look for repeated prompts, unusual login timing, multiple failed attempts followed by one success, and support calls that reference unexpected authentication requests.
Practitioner guidance
- Harden push approval policy Restrict approval-based MFA to lower-risk contexts and require stronger factors when device, location, or user confidence drops.
- Instrument prompt-burst detection Alert on repeated denials, timeouts, and rapid push sequences for the same account, especially when they appear outside normal sign-in patterns.
- Secure enrolment and recovery Require higher assurance for authenticator changes, and notify users immediately when a device is added, removed, or replaced.
Bottom line: Push prompt bombing works because it targets the human decision point inside approval-based MFA, not because the underlying cryptography is broken.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 6:06 pm
Push approval is an assertion, not an assurance: MFA prompt bombing exposes a basic weakness in approval-based authentication. The control asks the user to act as the verifier at the exact moment an attacker is trying to force a mistake, so the security decision is separated from the security signal. That makes the control susceptible to repetition, fatigue, and coercion, which is why it should be treated as a partial assurance factor rather than a standalone trust boundary.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What should teams do after a successful prompt bombing login?
A: Treat the account as potentially compromised. Revoke active sessions, review recent sign-ins, confirm that no new authenticators were enrolled, and require stronger authentication before restoring normal access. If the attacker can reach enrolment or recovery flows, the incident can turn into persistence instead of a single login event.
👉 Read our full editorial: MFA prompt bombing exposes the limits of push-based assurance